Pricing
Start free. Automate when you’re ready.
Discovery is always free and unlimited. You pay only for the endpoints you actively monitor.
Discover your certificate footprint in under 60 seconds. No credit card required.
Starter
$29/ month
Simple monitoring for small teams.
For small teams and first production deployments.
Monitored endpoints
100
Visibility
- ✓ Everything in Free
- ✓ Change monitoring
- ✓ Full risk score
Alerts
- ✓ Slack + Teams alerts
Team
- ✓ 1 seat
Start free
14-day trial
Most popular
Growth
$99/ month
Professional monitoring at growing scale.
For growing IT and security teams.
Monitored endpoints
300
Visibility
- ✓ Everything in Starter
- ✓ Endpoint health checks
- ✓ DNS zone sync
Integrations
- ✓ Webhooks + REST API
Team
- ✓ 3 seats
Start free
14-day trial
Business
$499/ month
Governance, compliance, and internal discovery.
For security and compliance teams.
Monitored endpoints
2,000
Discovery
- ✓ Everything in Growth
- ✓ Unlimited discovery (all sources)
- ✓ Agents · internal & private PKI
Governance
- ✓ SSO / SAML
- ✓ Advanced RBAC
- ✓ Compliance dashboards & reporting
Integrations
- ✓ ServiceNow / Jira / SIEM
Team
- ✓ 5 seats
Start free
14-day trial
Automation starts here
Automate
$1,499/ month
Renew and deploy certificates automatically.
Automation starts here — eliminate manual renewals.
Monitored endpoints
6,000
Automation (CLM)
- ✓ Everything in Business
- ✓ ACME renewal + deployment
- ✓ Multi-CA (DigiCert, Sectigo, GlobalSign)
- ✓ Approval workflows
Managed
- ✓ 250 managed endpoints included
- ✓ Overage per managed endpoint
Team
- ✓ 10 seats
Start free
14-day trial
Free $0 forever
Monitor 3 endpoints. Free certificate discovery. No credit card, ever.
Enterprise
Unlimited monitored & managed endpoints. On-prem / air-gapped / private cloud, HSM, MSP multi-tenant + white-label, and SLA. Includes Venafi / Keyfactor migration.
Contact sales
Custom terms
Not sure which plan? Start with Free — discovery is always free, and you can upgrade anytime.
Billing unit: a monitored endpoint (host:port). Discovery across all sources is free and unlimited — you pay only when you promote an endpoint to active monitoring.
Feature comparison
See what’s included in each tier.
| Feature | Free | Starter | Growth | Business | Automate | Enterprise |
|---|---|---|---|---|---|---|
| Free certificate discovery | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| CT-log monitoring | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| Expiry alerts | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| Change monitoring | — | ✓ | ✓ | ✓ | ✓ | ✓ |
| Risk score | Basic | Full | Full | Full | Full | Full |
| Slack / Teams alerts | — | ✓ | ✓ | ✓ | ✓ | ✓ |
| Endpoint health checks | — | — | ✓ | ✓ | ✓ | ✓ |
| Webhooks + REST API | — | — | ✓ | ✓ | ✓ | ✓ |
| Unlimited discovery (all sources) | — | — | — | ✓ | ✓ | ✓ |
| Agents · internal / private PKI | — | — | — | ✓ | ✓ | ✓ |
| SSO / RBAC / compliance | — | — | — | ✓ | ✓ | ✓ |
| CLM — renewal + deployment | — | — | — | — | ✓ | ✓ |
| Monitored endpoints | 3 | 100 | 300 | 2,000 | 6,000 | Unlimited |
| Managed endpoints | — | — | — | — | 250 incl. | Unlimited |
| Seats | 1 | 1 | 3 | 5 | 10 | Custom |
Which plan?
Which plan is right for me?
Choose Monitoring if…
You need visibility into certificates.
You want alerts before expiration.
You are not ready to automate renewals.
Choose Automate if…
You manage certificate renewals.
You need deployment automation.
You are preparing for 47-day TLS.
You want to eliminate manual certificate operations.
Not ready yet?
Start with a free account.
Monitor 3 endpoints, plus free certificate discovery. Forever free, no credit card.
Explore MachineCert FreeFAQ
Frequently asked questions
A monitored endpoint is a host:port that MachineCert actively tracks for expiry, risk, chain health, and changes. Your plan’s monitored-endpoint count is how many you can keep under active monitoring; discovery (a larger number) is always free and surfaces certificates before you promote them.
A managed endpoint is one MachineCert automates end to end — renewing, deploying, and rotating it through CLM. Managed endpoints are counted on the Automate tier and above, and always include monitoring.
Yes. The Automate tier includes the full monitoring and discovery feature set. Monitoring finds the problems; automation (CLM) fixes them. There is no separate monitoring subscription to buy.
No. You can start directly on the Automate tier — monitoring is built in. Many teams begin on a monitoring tier for visibility and move up to Automate when they’re ready to automate renewals, but it isn’t required.
Discovered certificates are all the certificates MachineCert finds across your public, cloud, and internal sources. Discovery is broad; the monitored/managed counts define how many you actively track or automate on your plan.
Billing is per monitored endpoint (host:port). A wildcard certificate is counted for each endpoint it is served on — a wildcard on three endpoints counts as three. Discovering that certificate is always free; you pay only for the endpoints you promote to monitoring.
Yes. A certificate with multiple Subject Alternative Names counts as one certificate, no matter how many hostnames are listed on it.
Neither. Pricing is based on the number of certificates monitored or managed — not per domain, per endpoint, or per deployment of the same certificate.
Yes. The Free plan includes free certificate discovery and lets you monitor 3 endpoints, forever, with no credit card required.
No. The Free plan and discovery scan require no credit card. You only add payment details if you move to a paid plan or start a trial that requires it.
At the end of a trial you can choose a paid plan to continue, or drop back to the Free plan. Your inventory and history are preserved either way.
Stop renewing
one cert at a time.
Free forever — monitor 3 endpoints. No credit card.